Answer

What do I actually own, and how do I install it?

The published create-accordo@0.1.0 scaffolds vendored source; it is the August 19 snapshot, not the current repository feature set. Use a current source checkout for the capabilities described here; upgrades require merging source (L-08). You own the source, and you get it by scaffolding: `npm create accordo` — the published `create-accordo@0.1.0` — scaffolds a project that boots, inspects and passes the project doctor, and it does so by copying the framework source into your repository; the same bootstrap also runs from a checkout. What does not exist is a framework dependency: the framework is vendored into the project, so upgrading means merging, not bumping a version (L-08). What you are left with is a Node application — Node 22 and a checkout, no build step, no bundler; SQLite is Node's built-in adapter, and PostgreSQL requires the one pinned driver pg@8.23.0 (C-17) — though that property belongs to the framework, not to whatever you add on top of it. A domain package you author attaches and detaches with the kernel's fingerprint unchanged and reaches another package only through a declared capability (C-13), and the scaffold that starts one writes an empty package and nothing else — no business logic, no composition, no global identity-uniqueness check — but there is no registry, marketplace, publication or sandboxing, package code runs with the host process's authority, and detaching leaves its data behind. There is nothing to sign up for: no hosted CRM, no free tier, no account (L-07).

What the ledger says, word for word

Each entry below is copied from site/claims.json, where it is bound to the evidence that holds it — a test file, a document, or a named repository fact — and to the limitation that travels with it. The answer above summarises these; these are the claim.

C-17

SQLite is Node's built-in node:sqlite. PostgreSQL requires one pinned runtime driver, pg@8.23.0. There is no ORM, no query builder, no build step and no framework underneath your framework.

LimitApplications that select PostgreSQL carry pg@8.23.0. The SQLite path still needs no third-party driver. This is not a production-readiness claim and not shared-database tenancy; composition is dedicated-database, not row tenancy.

tests/spine-v2-m3b-postgresql-adapter.test.jstests/api.test.jsARCHITECTURE.mdAGENTS.mdpackage.json.dependencies is exactly { pg: "8.23.0" }SQLite via node:sqlitethe HTTP server and test runner are Node built-insPostgreSQL uses the pinned pg@8.23.0 driver; there is no ORM

C-13

A customer-authored domain package attaches and detaches with the kernel's fingerprint unchanged, and reaches another package only through a capability it declares.

LimitThe scaffold that starts one writes an empty package and nothing else: no business logic, no composition, no global identity-uniqueness check. There is no registry, no marketplace, no publication and no sandboxing — package code runs with the host process's authority. Detaching leaves its data behind; there is no uninstall.

JTBD-PK-01, JTBD-PK-02tests/package-contract.test.jstests/custom-package-e2e.test.jstests/contracts-registry-review.test.jsdocs/PACKAGE_AUTHORING.md

L-08 · Ownership means vendored source: there is no framework dependency to bump.

The published create-accordo@0.1.0 scaffolds vendored source; it is the August 19 snapshot, not the current repository feature set. Use a current source checkout for the capabilities described here; upgrades require merging source (L-08). The framework is copied into the project, not installed as a framework library dependency. The accordo npm name is an empty reservation; the @accordo scope is claimed and deliberately empty.

tests/project-bootstrap.test.jsdocs/PROJECT_STATUS.mddocs/plans/project-bootstrap-installability.mdthe project bootstrap writes a project from an empty directory, dry-run unless --applytests/create-accordo-package.test.js packs the publication twice, byte-identically, installs it offline and runs the generated project's own checkssite/brand.json records the registry status and the source status as two separate fields, and scripts/distribution-check.js fails if either disagrees with the treepublication is staged from CI through OIDC trusted publishing and goes live only after a human approves the staged version with 2FA

L-07 · This is a framework, not a product you sign up for.

There is no hosted CRM, no free tier and no account. The output is an application in your repository that you run.

PRODUCT.mddocs/strategy/CATEGORY.md

Where this stops

Nothing on this page implies deployment readiness. The framework ships no authentication verifier; authorization is framework-enforced; tenant isolation is one tenant per application instance, not shared-database row tenancy. Read the exact repository posture before deployment. Every claim and every limitation is on one page, and the questions this project refuses to answer are published beside them.